Window Virtual Filtering Platform (VFP) Denial of Service Vulnerability

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• microsoft windows server 2016before 10.0.14393.9339
• microsoft windows server 2019before 10.0.17763.9020
• microsoft windows server 2022before 10.0.20348.5386
• microsoft windows server 2025before 10.0.26100.33158

Versions reported by the vendor

Affected version ranges reported by the assigning authority (microsoft). Independent of NVD's CPE analysis and usually ahead of it.

• Microsoft Windows 10 Version 1607

  • 10.0.14393.0 and later · before 10.0.14393.9339affected

• Microsoft Windows 10 Version 1809

  • 10.0.17763.0 and later · before 10.0.17763.9020affected

• Microsoft Windows 10 Version 21H2

  • 10.0.19044.0 and later · before 10.0.19044.7548affected

• Microsoft Windows 10 Version 22H2

  • 10.0.19045.0 and later · before 10.0.19045.7548affected

• Microsoft Windows 11 Version 24H2

  • 10.0.26100.0 and later · before 10.0.26100.8875affected

• Microsoft Windows 11 Version 25H2

  • 10.0.26200.0 and later · before 10.0.26200.8875affected

• Microsoft Windows 11 version 26H1

  • 10.0.28000.0 and later · before 10.0.28000.2525affected

• Microsoft Windows Server 2016

  • 10.0.14393.0 and later · before 10.0.14393.9339affected

• Microsoft Windows Server 2016 (Server Core installation)

  • 10.0.14393.0 and later · before 10.0.14393.9339affected

• Microsoft Windows Server 2019

  • 10.0.17763.0 and later · before 10.0.17763.9020affected

• Microsoft Windows Server 2019 (Server Core installation)

  • 10.0.17763.0 and later · before 10.0.17763.9020affected

• Microsoft Windows Server 2022

  • 10.0.20348.0 and later · before 10.0.20348.5386affected

Other highest-scoring records for the same primary product.

• CVE-2018-8174A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows VBScript Engine RemKEV
  86Now
• CVE-2022-44698Windows SmartScreen Security Feature Bypass VulnerabilityKEV
  74This week
• CVE-2026-21510Windows Shell Security Feature Bypass VulnerabilityKEV
  72This week
• CVE-2026-21513MSHTML Framework Security Feature Bypass VulnerabilityKEV
  70This week
• CVE-2023-24880Windows SmartScreen Security Feature Bypass VulnerabilityKEV
  70This week
• CVE-2026-33824Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution VulnerabilityKEV
  69This week

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

After a memory region is freed, another reference pointing to it is still used. By then, the same region may have been allocated for different data.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1free(dev->buf);2/* ... another thread is still running ... */3process(dev->buf);

1lock(&dev->lock);2free(dev->buf);3dev->buf = NULL;4unlock(&dev->lock);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.

MITRE has no CAPEC/ATT&CK mapping for this CWE.